Add 'server.remove-forward-headers' options

[bclozel]

Enabling that option should create a ForwardedHeaderFilter option and remove Forwarded headers.

This is especially useful if your application is looking at Forwarded headers even though it's not protected by a proxy (adding/removing those headers already).

See Rossen's comment in #10900 (comment) for more background about this.

[rstoyanchev]

An additional question is whether this property should be set by default. Doing so would cause applications that actually need to use forwarded headers to fail but the failure cause should be fairly obvious. The benefit is that it leads down a safer path of explicitly opting into the use of forwarded headers. Note also that setting the flag by default has the potential and likely will cause regression in applications that currently rely on forwarded headers implicitly, i.e. by virtue of using MvcUriComponentsBuilder or ServletUriComponentsBuilder to create links.

[bclozel]

One thing bothers me, though. If that's really insecure and not obvious, why is that the default in Spring Framework? Shouldn't ServletUriComponentsBuilder and MvcUriComponentsBuilder be safe by default?

[rstoyanchev]

That's just it though, there is no way to toggle this on and off in the Spring Framework. The only option would be to stop consuming those headers.

[rstoyanchev]

The only option would be to stop consuming those headers.

And that's what we intend to do in 5.1 https://jira.spring.io/browse/SPR-16668.

[sangeetha5491]

Is this still an active issue that needs to be worked on?

[wilkinsona]

@sangeetha5491 Yes, although I don't think we know exactly what form that work should take just yet.

[bclozel]

Since SPR-16668, Spring applications don't rely on forwaded headers by default. As explained in the Spring Framework migration docs, you either need to enable the forwarded headers support at the server level (which is what Spring Boot provides) or configure a ForwardedHeaderFilter.

If we provide a server.remove-forward-headers that configures a ForwardedHeaderFilter to remove all related headers, then we'd have two problems:

1. This might confuse developers using the forwarded headers support at the server level with Spring Boot; I think the server support should operate before the Servlet filter, making that filter a no-op?
2. Removing such headers might not help anymore since nothing consumes them in Spring at that point

With that in mind, I think we should close this issue. If developers need to remove those headers for a specific reason, then creating a ForwardedHeaderFilter bean and configuring it is perfectly fine.

[bclozel]

The team discussed this issue and we think that this is not useful.